{"id":3496542,"name":"github.com/gomarkdown/markdown","ecosystem":"go","description":"Package markdown implements a markdown parser and HTML renderer.","homepage":"https://github.com/gomarkdown/markdown","licenses":"BSD-2-Clause","normalized_licenses":["BSD-2-Clause"],"repository_url":"https://github.com/gomarkdown/markdown","keywords_array":[],"namespace":"github.com/gomarkdown","versions_count":69,"first_release_published_at":"2018-01-31T19:10:04.000Z","latest_release_published_at":"2026-10-16T09:07:43.910Z","latest_release_number":null,"last_synced_at":"2026-10-16T09:07:44.621Z","created_at":"2022-04-10T19:40:38.563Z","updated_at":"2026-10-16T20:19:18.345Z","registry_url":"https://pkg.go.dev/github.com/gomarkdown/markdown","install_command":"go get github.com/gomarkdown/markdown","documentation_url":"https://pkg.go.dev/github.com/gomarkdown/markdown#section-documentation","metadata":null,"repo_metadata":{"id":37458467,"uuid":"118966310","full_name":"gomarkdown/markdown","owner":"gomarkdown","description":"markdown parser and HTML renderer for Go","archived":false,"fork":false,"pushed_at":"2026-10-11T12:36:49.000Z","size":2283,"stargazers_count":1737,"open_issues_count":0,"forks_count":198,"subscribers_count":14,"default_branch":"master","last_synced_at":"2026-10-14T11:58:46.939Z","etag":null,"topics":["go","golang","markdown"],"latest_commit_sha":null,"homepage":"","language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"other","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/gomarkdown.png","metadata":{"files":{"readme":"README.md","changelog":"changes-from-blackfriday.md","contributing":null,"funding":null,"license":"LICENSE.txt","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"claude":null,"gemini":null,"cursor":null,"copilot":null,"dco":null,"cla":null,"disclosure":null}},"created_at":"2018-01-25T20:51:19.000Z","updated_at":"2026-10-11T13:50:38.000Z","dependencies_parsed_at":"2026-10-07T10:43:06.507Z","dependency_job_id":null,"html_url":"https://github.com/gomarkdown/markdown","commit_stats":{"total_commits":922,"total_committers":89,"mean_commits":"10.359550561797754","dds":0.7342733188720174,"last_synced_commit":"642f0ee99ae2bb0afa01b7e8fdfc14bf068dc7f1"},"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/gomarkdown/markdown","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gomarkdown%2Fmarkdown","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gomarkdown%2Fmarkdown/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gomarkdown%2Fmarkdown/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gomarkdown%2Fmarkdown/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/gomarkdown","download_url":"https://codeload.github.com/gomarkdown/markdown/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gomarkdown%2Fmarkdown/sbom","scorecard":{"id":434958,"data":{"date":"2025-08-11","repo":{"name":"github.com/gomarkdown/markdown","commit":"2e2c11897d1a50cd8ed1006f5623a106446b9d44"},"scorecard":{"version":"v5.2.1-40-gf6ed084d","commit":"f6ed084d17c9236477efd66e5b258b9d4cc7b389"},"score":4.1,"checks":[{"name":"Code-Review","score":3,"reason":"Found 10/26 approved changesets -- score normalized to 3","details":null,"documentation":{"short":"Determines if the project requires human code review before pull requests (aka merge requests) are merged.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#code-review"}},{"name":"Binary-Artifacts","score":10,"reason":"no binaries found in the repo","details":null,"documentation":{"short":"Determines if the project has generated executable (binary) artifacts in the source repository.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#binary-artifacts"}},{"name":"Token-Permissions","score":0,"reason":"detected GitHub workflow tokens with excessive permissions","details":["Warn: no topLevel permission defined: .github/workflows/go.yml:1","Info: no jobLevel write permissions found"],"documentation":{"short":"Determines if the project's workflows follow the principle of least privilege.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#token-permissions"}},{"name":"Maintained","score":4,"reason":"5 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 4","details":null,"documentation":{"short":"Determines if the project is \"actively maintained\".","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#maintained"}},{"name":"Packaging","score":-1,"reason":"packaging workflow not detected","details":["Warn: no GitHub/GitLab publishing workflow detected."],"documentation":{"short":"Determines if the project is published as a package that others can easily download, install, easily update, and uninstall.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#packaging"}},{"name":"Dangerous-Workflow","score":10,"reason":"no dangerous workflow patterns detected","details":null,"documentation":{"short":"Determines if the project's GitHub Action workflows avoid dangerous patterns.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#dangerous-workflow"}},{"name":"Pinned-Dependencies","score":0,"reason":"dependency not pinned by hash detected -- score normalized to 0","details":["Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/go.yml:9: update your workflow using https://app.stepsecurity.io/secureworkflow/gomarkdown/markdown/go.yml/master?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/go.yml:14: update your workflow using https://app.stepsecurity.io/secureworkflow/gomarkdown/markdown/go.yml/master?enable=pin","Warn: goCommand not pinned by hash: s/fuzz.sh:8","Warn: goCommand not pinned by hash: s/fuzz.sh:9","Warn: downloadThenRun not pinned by hash: s/test_with_codecoverage.sh:14","Info:   0 out of   2 GitHub-owned GitHubAction dependencies pinned","Info:   0 out of   2 goCommand dependencies pinned","Info:   0 out of   1 downloadThenRun dependencies pinned"],"documentation":{"short":"Determines if the project has declared and pinned the dependencies of its build process.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#pinned-dependencies"}},{"name":"CII-Best-Practices","score":0,"reason":"no effort to earn an OpenSSF best practices badge detected","details":null,"documentation":{"short":"Determines if the project has an OpenSSF (formerly CII) Best Practices Badge.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#cii-best-practices"}},{"name":"Security-Policy","score":0,"reason":"security policy file not detected","details":["Warn: no security policy file detected","Warn: no security file to analyze","Warn: no security file to analyze","Warn: no security file to analyze"],"documentation":{"short":"Determines if the project has published a security policy.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#security-policy"}},{"name":"License","score":9,"reason":"license file detected","details":["Info: project has a license file: LICENSE.txt:0","Warn: project license file does not contain an FSF or OSI license."],"documentation":{"short":"Determines if the project has defined a license.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#license"}},{"name":"Fuzzing","score":0,"reason":"project is not fuzzed","details":["Warn: no fuzzer integrations found"],"documentation":{"short":"Determines if the project uses fuzzing.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#fuzzing"}},{"name":"Signed-Releases","score":-1,"reason":"no releases found","details":null,"documentation":{"short":"Determines if the project cryptographically signs release artifacts.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#signed-releases"}},{"name":"Branch-Protection","score":0,"reason":"branch protection not enabled on development/release branches","details":["Warn: branch protection not enabled for branch 'master'"],"documentation":{"short":"Determines if the default and release branches are protected with GitHub's branch protection settings.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#branch-protection"}},{"name":"Vulnerabilities","score":10,"reason":"0 existing vulnerabilities detected","details":null,"documentation":{"short":"Determines if the project has open, known unfixed vulnerabilities.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#vulnerabilities"}},{"name":"SAST","score":0,"reason":"SAST tool is not run on all commits -- score normalized to 0","details":["Warn: 0 commits out of 14 are checked with a SAST tool"],"documentation":{"short":"Determines if the project uses static code analysis.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#sast"}}]},"last_synced_at":"2025-08-19T04:23:13.782Z","repository_id":37458467,"created_at":"2025-08-19T04:23:13.783Z","updated_at":"2025-08-19T04:23:13.783Z"},"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":344794859,"owners_count":38315658,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-10-03T21:59:58.778Z","status":"online","status_checked_at":"2026-10-14T02:00:06.392Z","response_time":82,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"},"owner_record":{"login":"gomarkdown","name":"gomarkdown","uuid":"35818011","kind":"organization","description":null,"email":null,"website":null,"location":null,"twitter":null,"company":null,"icon_url":"https://avatars.githubusercontent.com/u/35818011?v=4","repositories_count":3,"last_synced_at":"2026-10-14T08:58:22.494Z","metadata":{"has_sponsors_listing":false,"funding":null},"html_url":"https://github.com/gomarkdown","funding_links":[],"total_stars":1782,"followers":11,"following":0,"created_at":"2022-11-15T04:51:28.473Z","updated_at":"2026-10-14T08:58:22.511Z","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/gomarkdown","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/gomarkdown/repositories"},"tags":[]},"repo_metadata_updated_at":"2026-10-14T14:40:50.766Z","dependent_packages_count":1252,"downloads":null,"downloads_period":null,"dependent_repos_count":1009,"rankings":{"downloads":null,"dependent_repos_count":0.24327872524436758,"dependent_packages_count":0.15803849751431576,"stargazers_count":2.0679728639484987,"forks_count":2.244478504068143,"docker_downloads_count":0.41096060875678975,"average":1.0249458399064229},"purl":"pkg:golang/github.com/gomarkdown/markdown","advisories":[{"uuid":"GSA_kwCzR0hTQS1jdjIzLTd2YzUtamZoN84AB-CM","url":"https://github.com/advisories/GHSA-cv23-7vc5-jfh7","title":"gomarkdown/markdown IsSafeURL panics on short URLs","description":"## Summary\n\nIsSafeURL slices url[:nPath] before checking that len(url) \u003e= nPath, so a URL shorter than a path prefix (0, 1 or 2 bytes) triggers a slice-bounds panic, and this is reached end to end when the html.Safelink hardening flag is enabled and the input contains an empty or very short link destination, giving an unrecoverable crash DoS. Confirmed at HEAD (e08cff8; present since 2022).\n\n## The defect\n\nparser/parser.go, IsSafeURL:\n\n```go\nfunc IsSafeURL(url []byte) bool {\n    nLink := len(url)\n    for _, path := range validPaths {          // \"/\", \"./\", \"../\"\n        nPath := len(path)\n        linkPrefix := url[:nPath]               // line 789: sliced BEFORE the length guard\n        if nLink \u003e= nPath \u0026\u0026 bytes.Equal(linkPrefix, path) {   // line 790: guard is too late\n            ...\n```\n\nurl[:nPath] is evaluated before the `nLink \u003e= nPath` check. When len(url) \u003c nPath and cap(url) \u003c nPath, the slice expression panics. Only the relative-path loop is affected; the adjacent URIs loop is already correctly guarded (the signal that this one deviates, the same signal as the anchor). Input: IsSafeURL(\"\") panics ([:1] cap 0), IsSafeURL(\".\") panics ([:2] cap 1), IsSafeURL(\"..\") panics ([:3] cap 2), while IsSafeURL(\"/\") returns true. End to end: `markdown.ToHTML(input, html.CommonFlags|html.Safelink)` with input `[x]()` panics. Attacker model: (1) any service rendering untrusted Markdown with the html.Safelink flag (the URL-sanitizing hardening flag itself introduces the crash); or (2) any downstream that calls the exported parser.IsSafeURL on a 0/1/2-byte attacker URL, no flag required. No recover() anywhere, so an uncaught crash of the calling goroutine.\n\n## Verification\n\nEXECUTED with negative controls. Direct: the empty/1/2-char cases panic with the exact slice-bounds message while \"/\" returns true. End to end via ToHTML with html.CommonFlags|html.Safelink: `[x]()` panics, while `[x](/)`, `[x](http://example.com)`, plain text, and `[x](javascript:alert(1))` (safely dropped) do not. NOT verified: how many downstream apps enable Safelink or call IsSafeURL directly (the default no-Safelink render path does not reach it).\n\n## Suggested fix\n\nMove the slice inside the guard: check `nLink \u003e= nPath` first, then compute url[:nPath] (or use bytes.HasPrefix(url, path), which is length-safe). One-line change, mirroring the already-correct URIs loop.\n\nAlso checked and sound: CVE-2026-40890 (smartypants smartLeftAngle OOB) is fixed; CVE-2024-44337 (list/paragraph infinite loop) is fixed (deep nesting capped at maxNesting=64); default XSS is by design (Safelink/SkipHTML not in CommonFlags).\n\n## Tooling\n\nAI assistance was used while investigating. The panic is executed-verified with negative controls (IsSafeURL on empty/./.. panics with a slice-bounds error while \"/\" returns true; ToHTML with html.Safelink on `[x]()` panics while valid and javascript: links do not), and I confirmed at HEAD that IsSafeURL computes url[:nPath] before the `nLink \u003e= nPath` guard.","origin":"UNSPECIFIED","severity":"HIGH","published_at":"2026-10-16T15:41:39.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":7.5,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","references":["https://github.com/gomarkdown/markdown/security/advisories/GHSA-cv23-7vc5-jfh7","https://github.com/gomarkdown/markdown/commit/61af6e1e69710c5ca13cfbaaaa1bc11bc763a8a9","https://github.com/advisories/GHSA-cv23-7vc5-jfh7"],"source_kind":"github","identifiers":["GHSA-cv23-7vc5-jfh7","CVE-2026-102941"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-10-16T16:00:30.557Z","updated_at":"2026-10-16T20:00:53.413Z","epss_percentage":null,"epss_percentile":null,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1jdjIzLTd2YzUtamZoN84AB-CM","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS1jdjIzLTd2YzUtamZoN84AB-CM","packages":[{"ecosystem":"go","package_name":"github.com/gomarkdown/markdown","versions":[{"first_patched_version":"0.0.0-20260724235538-61af6e1e6971","vulnerable_version_range":"\u003c 0.0.0-20260724235538-61af6e1e6971"}],"purl":"pkg:go/github.com%2Fgomarkdown%2Fmarkdown"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1jdjIzLTd2YzUtamZoN84AB-CM/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS03N2ZqLXZ4NTQtZ3ZoN84ABVS-","url":"https://github.com/advisories/GHSA-77fj-vx54-gvh7","title":"Go Markdown has an Out-of-bounds Read in SmartypantsRenderer","description":"### Summary\n\nProcessing a malformed input containing a `\u003c` character that is not followed by a `\u003e` character anywhere in the remaining text with a SmartypantsRenderer will lead to Out of Bounds read or a panic.\n\n### Details\n\nThe `smartLeftAngle()` function in `html/smartypants.go:367-376` performs an out-of-bounds slice operation when processing a `\u003c` character that is not followed by a `\u003e` character anywhere in the remaining text.\nhttps://github.com/gomarkdown/markdown/blob/37c66b85d6ab025ba67a73ba03b7f3ef55859cca/html/smartypants.go#L367-L376\nIf the length of the slice is lower than its capacity, this leads to an extra byte of data read. If the length equals the capacity, this leads to a panic.\n\n### PoC\n```golang\npackage main\n\nimport (\n\t\"bytes\"\n\t\"fmt\"\n\n\t\"github.com/gomarkdown/markdown/html\"\n)\n\nfunc main() {\n\tsrc := []byte(\"\u003ca\")\n\n\tfmt.Printf(\"Input: %q  (len=%d, cap=%d)\\n\", src, len(src), cap(src))\n\n\tvar buf bytes.Buffer\n\tsp := html.NewSmartypantsRenderer(html.Smartypants)\n\tsp.Process(\u0026buf, src) // panics: slice bounds out of range\n\n\tfmt.Printf(\"Output: %q\\n\", buf.String())\n}\n```\n\n### Impact\nThis vulnerability will lead to a Denial of Service / panic on the processing service.\n\n\n-- The Datadog Security Team","origin":"UNSPECIFIED","severity":"HIGH","published_at":"2026-04-14T22:38:20.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":7.5,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","references":["https://github.com/gomarkdown/markdown/security/advisories/GHSA-77fj-vx54-gvh7","https://github.com/gomarkdown/markdown/commit/759bbc3e32073c3bc4e25969c132fc520eda2778","https://nvd.nist.gov/vuln/detail/CVE-2026-40890","https://github.com/advisories/GHSA-77fj-vx54-gvh7"],"source_kind":"github","identifiers":["GHSA-77fj-vx54-gvh7","CVE-2026-40890"],"repository_url":null,"blast_radius":0.0,"created_at":"2026-04-14T23:00:11.535Z","updated_at":"2026-10-16T06:04:10.927Z","epss_percentage":0.00515,"epss_percentile":0.42518,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS03N2ZqLXZ4NTQtZ3ZoN84ABVS-","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS03N2ZqLXZ4NTQtZ3ZoN84ABVS-","packages":[{"ecosystem":"go","package_name":"github.com/gomarkdown/markdown","versions":[{"first_patched_version":"0.0.0-20260411013819-759bbc3e3207","vulnerable_version_range":"\u003c 0.0.0-20260411013819-759bbc3e3207"}],"purl":"pkg:go/github.com%2Fgomarkdown%2Fmarkdown"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS03N2ZqLXZ4NTQtZ3ZoN84ABVS-/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS14aHIzLXdmN2otaDI1Nc4ABATH","url":"https://github.com/advisories/GHSA-xhr3-wf7j-h255","title":"Infinite loop in github.com/gomarkdown/markdown","description":"The package `github.com/gomarkdown/markdown` is a Go library for parsing Markdown text and rendering as HTML. Prior to pseudoversion `v0.0.0-20240729232818-a2a9c4f`, which corresponds with commit `a2a9c4f76ef5a5c32108e36f7c47f8d310322252`, there was a logical problem in the paragraph function of the parser/block.go file, which allowed a remote attacker to cause a denial of service (DoS) condition by providing a tailor-made input that caused an infinite loop, causing the program to hang and consume resources indefinitely. Submit `a2a9c4f76ef5a5c32108e36f7c47f8d310322252` contains fixes to this problem.","origin":"UNSPECIFIED","severity":"MODERATE","published_at":"2024-10-15T21:30:39.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":6.9,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","references":["https://nvd.nist.gov/vuln/detail/CVE-2024-44337","https://github.com/gomarkdown/markdown/commit/a2a9c4f76ef5a5c32108e36f7c47f8d310322252","https://github.com/Brinmon/CVE-2024-44337","https://pkg.go.dev/vuln/GO-2024-3205","https://github.com/advisories/GHSA-xhr3-wf7j-h255"],"source_kind":"github","identifiers":["GHSA-xhr3-wf7j-h255","CVE-2024-44337"],"repository_url":"https://github.com/gomarkdown/markdown","blast_radius":20.726849047034683,"created_at":"2024-10-16T15:06:40.467Z","updated_at":"2026-10-16T06:08:09.208Z","epss_percentage":0.00501,"epss_percentile":0.41516,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS14aHIzLXdmN2otaDI1Nc4ABATH","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS14aHIzLXdmN2otaDI1Nc4ABATH","packages":[{"ecosystem":"go","package_name":"github.com/gomarkdown/markdown","versions":[{"first_patched_version":"0.0.0-20240729212818-a2a9c4f76ef5","vulnerable_version_range":"\u003c 0.0.0-20240729212818-a2a9c4f76ef5"}],"purl":"pkg:go/github.com%2Fgomarkdown%2Fmarkdown"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS14aHIzLXdmN2otaDI1Nc4ABATH/related_packages","related_advisories":[]},{"uuid":"GSA_kwCzR0hTQS1tOXhxLTZoMmotNjVyMs4AA2Ar","url":"https://github.com/advisories/GHSA-m9xq-6h2j-65r2","title":"Markdown vulnerable to Out-of-bounds Read while parsing citations","description":"### Summary\nParsing malformed markdown input with parser that uses parser.Mmark extension could result in out-of-bounds read vulnerability.\n\n### Details\nTo exploit the vulnerability, parser needs to have parser.Mmark extension set. The panic occurs inside the `citation.go` file on the line 69 when the parser tries to access the element past its length.\n\nhttps://github.com/gomarkdown/markdown/blob/7478c230c7cd3e7328803d89abe591d0b61c41e4/parser/citation.go#L69\n\n### PoC\n```go\npackage main\n\nimport (\n\t\"github.com/gomarkdown/markdown\"\n\t\"github.com/gomarkdown/markdown/parser\"\n)\n\nfunc main() {\n\text := parser.CommonExtensions |\n\t\tparser.Attributes |\n\t\tparser.OrderedListStart |\n\t\tparser.SuperSubscript |\n\t\tparser.Mmark\n\tp := parser.NewWithExtensions(ext)\n\n\tinp := []byte(\"[@]\")\n\tmarkdown.ToHTML(inp, p, nil)\n}\n```\n\n```bash\n$ go run main.go\npanic: runtime error: index out of range [1] with length 1\n\ngoroutine 1 [running]:\ngithub.com/gomarkdown/markdown/parser.citation(0x10?, {0x1400000e3f0, 0x14000141801?, 0x3}, 0x0?)\n\t/Users/demon/go/pkg/mod/github.com/gomarkdown/markdown@v0.0.0-20230916125811-7478c230c7cd/parser/citation.go:69 +0x544\ngithub.com/gomarkdown/markdown/parser.link(0x14000152000?, {0x1400000e3f0?, 0x3?, 0x3?}, 0x14000141ad8?)\n\t/Users/demon/go/pkg/mod/github.com/gomarkdown/markdown@v0.0.0-20230916125811-7478c230c7cd/parser/inline.go:308 +0x1c0\ngithub.com/gomarkdown/markdown/parser.(*Parser).Inline(0x14000152000, {0x102d87f48, 0x14000076180}, {0x1400000e3f0, 0x3, 0x3})\n\t/Users/demon/go/pkg/mod/github.com/gomarkdown/markdown@v0.0.0-20230916125811-7478c230c7cd/parser/inline.go:38 +0xb8\ngithub.com/gomarkdown/markdown/parser.(*Parser).Parse.func1({0x102d87f48?, 0x14000076180}, 0x0?)\n\t/Users/demon/go/pkg/mod/github.com/gomarkdown/markdown@v0.0.0-20230916125811-7478c230c7cd/parser/parser.go:307 +0x8c\ngithub.com/gomarkdown/markdown/ast.NodeVisitorFunc.Visit(0x140000106e0?, {0x102d87f48?, 0x14000076180?}, 0x68?)\n\t/Users/demon/go/pkg/mod/github.com/gomarkdown/markdown@v0.0.0-20230916125811-7478c230c7cd/ast/node.go:574 +0x38\ngithub.com/gomarkdown/markdown/ast.Walk({0x102d87f48, 0x14000076180}, {0x102d87348, 0x140000106e0})\n\t/Users/demon/go/pkg/mod/github.com/gomarkdown/markdown@v0.0.0-20230916125811-7478c230c7cd/ast/node.go:546 +0x58\ngithub.com/gomarkdown/markdown/ast.Walk({0x102d877b0, 0x14000076120}, {0x102d87348, 0x140000106e0})\n\t/Users/demon/go/pkg/mod/github.com/gomarkdown/markdown@v0.0.0-20230916125811-7478c230c7cd/ast/node.go:557 +0x144\ngithub.com/gomarkdown/markdown/ast.WalkFunc(...)\n\t/Users/demon/go/pkg/mod/github.com/gomarkdown/markdown@v0.0.0-20230916125811-7478c230c7cd/ast/node.go:580\ngithub.com/gomarkdown/markdown/parser.(*Parser).Parse(0x14000152000, {0x1400000e3f0?, 0x0?, 0x0?})\n\t/Users/demon/go/pkg/mod/github.com/gomarkdown/markdown@v0.0.0-20230916125811-7478c230c7cd/parser/parser.go:304 +0x16c\ngithub.com/gomarkdown/markdown.Parse({0x1400000e3f0?, 0x3f?, 0x14000141e38?}, 0x102c6b43c?)\n\t/Users/demon/go/pkg/mod/github.com/gomarkdown/markdown@v0.0.0-20230916125811-7478c230c7cd/markdown.go:53 +0x6c\ngithub.com/gomarkdown/markdown.ToHTML({0x1400000e3f0?, 0x0?, 0x60?}, 0x0?, {0x0, 0x0})\n\t/Users/demon/go/pkg/mod/github.com/gomarkdown/markdown@v0.0.0-20230916125811-7478c230c7cd/markdown.go:77 +0x30\nmain.main()\n\t/Users/demon/tools/markdown_cve_poc/main.go:17 +0x5c\nexit status 2\n```\n\n### Impact\nDenial of Service / panic\n","origin":"UNSPECIFIED","severity":"HIGH","published_at":"2023-09-22T19:59:49.000Z","withdrawn_at":null,"classification":"GENERAL","cvss_score":7.5,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","references":["https://github.com/gomarkdown/markdown/security/advisories/GHSA-m9xq-6h2j-65r2","https://nvd.nist.gov/vuln/detail/CVE-2023-42821","https://github.com/gomarkdown/markdown/commit/14b16010c2ee7ff33a940a541d993bd043a88940","https://github.com/gomarkdown/markdown/blob/7478c230c7cd3e7328803d89abe591d0b61c41e4/parser/citation.go#L69","https://github.com/advisories/GHSA-m9xq-6h2j-65r2"],"source_kind":"github","identifiers":["GHSA-m9xq-6h2j-65r2","CVE-2023-42821"],"repository_url":"https://github.com/gomarkdown/markdown","blast_radius":0.0,"created_at":"2023-09-22T20:05:51.351Z","updated_at":"2026-10-08T07:59:10.683Z","epss_percentage":0.01252,"epss_percentile":0.68531,"api_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1tOXhxLTZoMmotNjVyMs4AA2Ar","html_url":"https://advisories.ecosyste.ms/advisories/GSA_kwCzR0hTQS1tOXhxLTZoMmotNjVyMs4AA2Ar","packages":[{"ecosystem":"go","package_name":"github.com/gomarkdown/markdown","versions":[{"first_patched_version":"0.0.0-20230922105210-14b16010c2ee","vulnerable_version_range":"\u003c 0.0.0-20230922105210-14b16010c2ee"}],"purl":"pkg:go/github.com%2Fgomarkdown%2Fmarkdown"}],"related_packages_url":"https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1tOXhxLTZoMmotNjVyMs4AA2Ar/related_packages","related_advisories":[]}],"docker_usage_url":"https://docker.ecosyste.ms/usage/go/github.com/gomarkdown/markdown","docker_dependents_count":64,"docker_downloads_count":186032163,"usage_url":"https://repos.ecosyste.ms/usage/go/github.com/gomarkdown/markdown","dependent_repositories_url":"https://repos.ecosyste.ms/api/v1/usage/go/github.com/gomarkdown/markdown/dependencies","status":null,"funding_links":[],"critical":null,"issue_metadata":{"last_synced_at":"2026-10-14T06:30:43.699Z","issues_count":115,"pull_requests_count":66,"avg_time_to_close_issue":26997931.435185187,"avg_time_to_close_pull_request":635764.4769230769,"issues_closed_count":108,"pull_requests_closed_count":65,"pull_request_authors_count":33,"issue_authors_count":87,"avg_comments_per_issue":2.3478260869565215,"avg_comments_per_pull_request":1.5606060606060606,"merged_pull_requests_count":55,"bot_issues_count":0,"bot_pull_requests_count":0,"past_year_issues_count":5,"past_year_pull_requests_count":6,"past_year_avg_time_to_close_issue":4823141.2,"past_year_avg_time_to_close_pull_request":1442281.1666666667,"past_year_issues_closed_count":5,"past_year_pull_requests_closed_count":6,"past_year_pull_request_authors_count":5,"past_year_issue_authors_count":5,"past_year_avg_comments_per_issue":0.8,"past_year_avg_comments_per_pull_request":1.0,"past_year_bot_issues_count":0,"past_year_bot_pull_requests_count":0,"past_year_merged_pull_requests_count":4,"issues_url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/repositories/gomarkdown%2Fmarkdown/issues","maintainers":[{"login":"miekg","count":11,"url":"https://issues.ecosyste.ms/api/v1/hosts/GitHub/authors/miekg"}],"active_maintainers":[]},"versions_url":"https://packages.ecosyste.ms/api/v1/registries/proxy.golang.org/packages/github.com%2Fgomarkdown%2Fmarkdown/versions","version_numbers_url":"https://packages.ecosyste.ms/api/v1/registries/proxy.golang.org/packages/github.com%2Fgomarkdown%2Fmarkdown/version_numbers","latest_version_url":"https://packages.ecosyste.ms/api/v1/registries/proxy.golang.org/packages/github.com%2Fgomarkdown%2Fmarkdown/latest_version","dependent_packages_url":"https://packages.ecosyste.ms/api/v1/registries/proxy.golang.org/packages/github.com%2Fgomarkdown%2Fmarkdown/dependent_packages","related_packages_url":"https://packages.ecosyste.ms/api/v1/registries/proxy.golang.org/packages/github.com%2Fgomarkdown%2Fmarkdown/related_packages","codemeta_url":"https://packages.ecosyste.ms/api/v1/registries/proxy.golang.org/packages/github.com%2Fgomarkdown%2Fmarkdown/codemeta","maintainers":[]}